That's interesting. But let's say I am a nation state hell bent on intercepting everything or even a major ISP in the region, can't I remove Except-CT header from all outgoing HTTPS responses?